Patch management

NIST SP 800-40 Rev. 4 (2022) reframes patching as preventive maintenance and recommends that organisations define a small number of maintenance plans by asset type and risk rather than treat each patch as a project. It distinguishes routine patching on a regular cadence from emergency patching for vulnerabilities that are actively exploited or critical on exposed systems, and adds two alternatives when no patch can be applied: mitigation (configuration changes, virtual patching at an IPS or WAF, isolation) and risk acceptance with a documented owner and expiry. A patch cycle typically runs: intake from vendor advisories and vulnerability feeds, applicability matching against the asset and software inventory, prioritisation, testing, staged deployment in rings (a pilot group, then broad deployment), verification, and exception handling.

Prioritisation has moved beyond CVSS base scores, which describe technical severity but not likelihood. Common inputs now include CISA's Known Exploited Vulnerabilities (KEV) catalogue, which US federal agencies must act on under Binding Operational Directive 26-04 (June 2026, replacing BOD 22-01), with a deadline for each CVE set by the asset's exposure, KEV status, whether exploitation can be automated and the technical impact, as short as three days for an internet-facing asset with an automatable KEV that gives total control; the Exploit Prediction Scoring System (EPSS) from FIRST, which estimates the probability of exploitation in the next 30 days; internet exposure; and asset criticality. Time-to-exploit for publicised vulnerabilities has fallen to days in many cases, so edge devices - VPN concentrators, firewalls, file-transfer appliances - are generally treated as emergency-class regardless of internal SLAs.

Operational realities complicate the cycle. Microsoft releases security updates on the second Tuesday of each month (Patch Tuesday), but third-party applications, browsers, firmware (BIOS/UEFI, BMC, network devices) and container base images follow their own rhythms. Reboots, maintenance windows and application compatibility create lag; medical and OT systems may be certified only for specific versions and require vendor approval. End-of-life software receives no patches at all and must be isolated or replaced. Tooling is shifting toward cloud-managed services, and Microsoft announced in 2024 that WSUS is deprecated, with no new feature development. In containerised environments the unit of patching is the image: fixes are applied by rebuilding from an updated base and redeploying, not by patching running containers.

Metrics that auditors and boards ask for are coverage (share of assets reporting patch status), mean time to remediate by severity, and SLA compliance, with exceptions tracked explicitly. The control anchors are CIS Controls v8 Control 7 (Safeguards 7.3 and 7.4 on automated OS and application patching), ISO/IEC 27002:2022 control 8.8 (management of technical vulnerabilities) and NIS2 Art. 21(2)(e) on vulnerability handling. Patch management is complementary to vulnerability scanning, which verifies that patches actually landed, and to hardening, which removes components that would otherwise need patching.